Popup Maker WP EUVD-2026-91211

Exploitation requires an authenticated WordPress account with as little as Subscriber-level privileges, which in practice means the target site must allow user self-registration or the attacker must already possess low-privileged credentials - this is the primary limiting factor. The attacker must reach the plugin's management page, which the plugin fails to restrict by capability, and store display-targeting values that the plugin later treats as PHP callables. A further structural limit is that only zero-argument callables are invoked, so the attacker cannot pass controlled parameters, bounding impact to information disclosure and denial of service rather than full remote code execution. The affected product is Popup Maker WP versions through 1.4.5; no special server configuration beyond a default plugin install and an available low-privilege login is needed.

This is a moderate, authenticated access-control flaw whose real-world priority sits below its CVSS 5.4 'Medium' rating for most environments. The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N) confirms network reach and low attack complexity, but PR:L means the attacker must already hold a low-privileged WordPress account (e.g., Subscriber) - so exploitation depends entirely on the site permitting user registration, which is the key gating condition. Publicly available exploit code exists (reported by WPScan), which raises the practical likelihood that this will be folded into automated WordPress plugin scanners, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active exploitation and no quantitative probability signal to weigh. No SSVC decision data was supplied. The impact is deliberately bounded: the flaw permits invoking only zero-argument PHP callables, yielding information disclosure (C:L) and denial of service (A:L) with no integrity impact (I:N) - not arbitrary code execution with attacker-controlled arguments, so this is not a full RCE despite the alarming 'PHP callable' phrasing. Net assessment: a real but second-tier issue - patch in routine cycles, prioritize sooner on any site that allows open self-registration.

An attacker self-registers (or abuses an existing low-privilege account) as a Subscriber on a WordPress site running Popup Maker WP ≤ 1.4.5, then accesses the improperly protected management page to store malicious display-targeting values. On the next public page load, the plugin invokes those values as zero-argument PHP callables, triggering disclosure of sensitive runtime information or a denial-of-service condition. Public exploit code for this flaw is available via WPScan, lowering the skill barrier.